If you have ever scrolled to the bottom of a therapy-practice website and seen links for Privacy Policy, Notice of Privacy Practices, HIPAA Notice, and possibly Terms & Conditions, you could be forgiven for assuming these are all approximately the same legal document. I actually thought that for a long time, too, until I started going down the path of helping therapists with their websites.
Then, I quickly learned that Privacy Policy and Notice of Privacy Practices are not the same.
Honestly, I think this is one reason practice owners get confused about website privacy. So, what is a Notice of Privacy Practices?
A HIPAA Notice of Privacy Practices has a specific purpose, and it is to tell your clients how your practice may use and disclose their protected health information (PHI), what rights they have regarding that information, and what responsibilities your practice has under HIPAA.
If you are a HIPAA-covered therapy practice, this is not optional because it is part of how HIPAA gives people information about their privacy rights.
As of late 2026, there are also some important updated requirements worth knowing.
What is a Notice of Privacy Practices?
HIPAA's Notice of Privacy Practices, usually abbreviated NPP, explains a covered entity's privacy practices to the people whose health information it holds.
The HIPAA Privacy Rule generally requires covered health-care providers and health plans to develop and distribute a notice explaining how PHI may be used and disclosed, the individual's rights, and the covered entity's legal responsibilities.
For therapists and counseling practices, clients usually receive this document as part of the intake process and acknowledge receipt. You likely already have a version of this, but the intake packet is not the only place it belongs. If you maintain a website that describes your services or benefits, HHS requires the notice to be prominently posted and made available through that website, so the website copy matters, too.
Is a Notice of Privacy Practices the same as a website privacy policy?
No. In my opinion, this deserves a giant blinking sign because I kind of thought they were the same thing.
A HIPAA Notice of Privacy Practices explains what the health-care practice does with PHI and what HIPAA rights the patient has.
A website privacy policy generally explains how the website itself collects and uses information through things like forms, cookies, analytics, account registration, marketing tools, and other website technology.
Those documents can cover some of the same information, but they serve different purposes. For example, your NPP may explain that your practice can use PHI for treatment, payment, and health-care operations. Your website privacy policy might explain that the site uses certain analytics technologies, what information a newsletter form collects, or whether it uses cookies.
Neither one, by itself, substitutes for a HIPAA authorization when HIPAA requires specific authorization for a disclosure. HHS explicitly says a Notice of Privacy Practices is not a way to bypass an authorization requirement. That matters when we start talking about analytics and tracking pixels.
What needs to be in a therapist's Notice of Privacy Practices?
HHS describes several core things the notice must communicate:
How the practice may use and disclose protected health information.
The client’s rights with respect to that information and how the client can exercise those rights
Legal duties regarding PHI, including the responsibility to protect the privacy of that information and follow the terms of its notice
Who to contact for more information or to make a privacy complaint
Effective date
That is the basic framework of a Notice of Privacy Practices, and the current HHS model notice makes those requirements much easier to understand in ordinary language.
Your clients' rights belong in the notice
The current HHS model Notice of Privacy Practices presents clients’ rights in a much more human way than most old-school HIPAA documents.
Among other rights, people may have the right to access copies of their records, request corrections, ask for confidential communications, request certain restrictions, obtain an accounting of certain disclosures, receive a copy of the privacy notice, choose someone to act on their behalf, and file a complaint if they believe their privacy rights were violated.
The details and limitations of those rights matter, so I would not rewrite the entire rights section from memory because you want your document to sound friendlier. You can use the current requirements and model language as your foundation.
Then you can modify it to make it readable. These goals are compatible, but they also need to be reviewed by an attorney or legal representative to make sure you haven’t modified it to the point of it no longer being accurate.
The notice also explains when the practice can use or share information
This is probably the part most clients think of when they hear “HIPAA.” The NPP should explain the circumstances under which a practice may use or disclose PHI. HHS's current provider model includes common areas such as treatment, running the organization, billing for services, responding to public-health and safety issues, complying with law, responding to legal matters, and other circumstances allowed or required by law.
The notice must reflect what applies to your practice, and this is why I would avoid grabbing one and replacing the practice name without really combing through it. Your privacy notice should describe your actual practices.
Your responsibilities belong there too
The notice also explains what the practice owes the client.
HHS's current model makes clear that covered providers must maintain the privacy and security of PHI, follow the notice currently in effect, and notify affected people after certain breaches of unsecured PHI. This matters because the NPP is describing what your practice must do if something happens to the data. So, in other words, make sure that your systems support what you say in your NPP.
You need a privacy contact
Your notice must tell people whom to contact with questions or complaints about the practice. For a small solo practice, that may be the therapist. For a larger group, it may be a designated privacy officer or administrator.
The important thing is that the person exists and the contact information works. The notice must also explain that an individual can complain to HHS if they believe their privacy rights have been violated and that the practice will not retaliate against them for filing a complaint. The HHS model notice includes this directly.
This shouldn't point to an abandoned inbox nobody checks, so make sure it's a place people actually monitor.
There was an important NPP update in 2026
As of February 16, 2026, HIPAA-covered entities are required to include new information in their Notices of Privacy Practices related to substance-use-disorder records protected under federal Part 2 rules. HHS released revised model notices in February 2026 reflecting the changes from the 2024 Part 2 Final Rule and related HIPAA Privacy Rule changes.
That does not mean every therapist needs to become an expert in 42 CFR Part 2 overnight, but it does mean that if you’ve been using the same template for years, 2026 is a good year to review it. HHS’s revised provider model is a good starting point.
Where should the Notice of Privacy Practices go on a therapist's website?
The short answer is that the NPP should be easy to find on the website.
HIPAA requires covered entities to prominently post the notice and make it available on any website they maintain that provides information about customer services or benefits.
I would usually put a clearly labeled link in the global footer:
Notice of Privacy Practices
If you have an intake or new-client page, it can also make sense to link to the NPP there. The important thing is that the website provides access to the actual current notice.
Does putting it on the website replace giving it to clients?
No.
For health-care providers with direct treatment relationships, HIPAA generally requires the provider to give the NPP to the individual no later than the first service delivery and make a good-faith effort to obtain written acknowledgment that the person received it.
Providers with a physical site where they directly treat people must also post the notice prominently at that location.
So the website requirement is one distribution method that does not replace the rest.
Do clients have to “agree” to the Notice of Privacy Practices?
HIPAA generally requires a direct-treatment provider to make a good-faith effort to obtain acknowledgment that the individual received the notice.
That is not the same as asking the client to sign away privacy rights or grant blanket permission for everything described in it.
The notice tells the client about the practice’s privacy practices. It isn’t meant to become an all-purpose authorization document. This is also why I would avoid combining the NPP acknowledgment with unrelated waivers or permissions unless someone qualified has reviewed the structure.
What about a website privacy policy?
Most therapy-practice websites should think through their website privacy policy separately, especially if the site uses analytics, cookies, contact forms, mailing lists, scheduling tools, advertising technologies, or other third-party services.
That policy should reflect what the website actually does.
If you say the site does not share data with third parties while six third-party marketing scripts fire on every page, better legal wording won't fix the problem because the data flow and the policy need to match.
Similarly, a website privacy policy stating that a tracking technology is used does not make a PHI disclosure HIPAA-permissible. HHS's tracking guidance is explicit that ordinary privacy-policy disclosures and cookie banners do not substitute for HIPAA authorization when authorization is required.
Your BAA and your NPP should not contradict one another
This is another easy-to-miss connection. HHS notes that a covered entity must ensure through its business-associate contracts that business associates' uses and disclosures of PHI are consistent with the covered entity's privacy policies as described in its notice. This makes sense. Generally, your NPP cannot tell clients one thing while your vendor agreements allow something incompatible.
The privacy documentation should describe the system you actually operate.
The goal should be something clients can actually understand
HIPAA requires the notice because people have a right to understand what happens to their health information, but that purpose gets somewhat lost when the notice becomes seven pages of tiny legal text that everybody signs without reading.
HHS describes the NPP as a clear, user-friendly explanation of people's privacy rights and the organization's privacy practices. We should take that seriously. We can make that possible by:
Using headings
Using readable type
Making contact information obvious
Keeping the required substance intact but making it more accessible
A person beginning therapy is already being asked to read a considerable amount of paperwork. Privacy information can be legally accurate and easy to read, it doesn’t have to be either/or.
Privacy practices should match the actual practice
That is probably the theme connecting all of these HIPAA website questions for me. The NPP should not be a document you generate once, put in the footer, and mentally declare HIPAA completed. Instead, it should describe something real. If the notice talks about how the practice protects PHI, the technology choices should reflect that. Appropriate BAAs should exist. If your website is sending information to analytics or advertising tools, that needs to be looked at closely. Whenever your systems change, the document needs to be revisited.
The notices explain your system to the people who are trusting you with their information. And when you think about it like that, the NPP makes a whole lot more sense.
Frequently asked questions
Does a therapist need a Notice of Privacy Practices?
HIPAA-covered health-care providers generally must provide an NPP explaining uses and disclosures of PHI, individuals' rights, and the provider's responsibilities. Whether an individual therapist is a HIPAA covered entity depends on the provider's circumstances.
Does the NPP need to be on a therapy website?
If a covered entity maintains a website that provides information about its services or benefits, HHS requires the notice to be prominently posted and available there.
Is a HIPAA Notice of Privacy Practices the same as a privacy policy?
No. The HIPAA NPP explains the covered provider's PHI practices and patients' HIPAA rights. A website privacy policy generally addresses information collected through the website and its technologies. Depending on the practice and site, both may be relevant.
What changed about the NPP in 2026?
As of February 16, 2026, covered entities must include information related to certain substance-use-disorder records under updated Part 2 requirements. HHS released revised model notices reflecting those changes.
Can I use the HHS model Notice of Privacy Practices?
HHS specifically provides model notices that regulated entities can customize with their own information. The model is a much better starting point than copying another practice's document.
This article is educational and not legal advice. Privacy requirements can vary depending on the practice, state law, services provided, and the information involved. Practices should use current HHS guidance and qualified legal or compliance support when creating or revising their notices.